HEADQUARTER privacy policy

Polymer Workshop ApS, CVR 43931636, C/O ByMan Cykler, Øster Farimagsgade 32, 2100 København Ø, Denmark, is the data controller for the processing described here. Contact: info@polymerworkshop.com.

HEADQUARTER is the company’s internal operations application. It is used by the company for its own business and is not offered to other companies.

• People who use the application: the company’s personnel and the logistics and accounting providers acting on its instructions.
• People named on an order: the contact at a wholesale customer, and the recipient of a webshop order.

• Account data for users: name, work email address, role and sign-in records.
• Order and delivery data: customer or company name, contact email, delivery address, phone number where a carrier requires one, order lines, prices and order status.
• Shipment data: parcel numbers, carrier, labels and tracking status.
• Invoice data read from the accounting system: invoice number, date, customer number and order reference.

No special categories of personal data are processed, and the application makes no automated decision that produces a legal effect for an individual.

• To fulfil and ship orders, and to confirm that an order has been invoiced before goods leave the warehouse: performance of a contract, and the company’s legitimate interest in shipping only what has been invoiced.
• To keep accounting records: compliance with a legal obligation under the Danish Bookkeeping Act.
• To operate and secure the application, including sign-in and error logs: the company’s legitimate interest in a working and secure system.

Personal data is shared with the providers the company uses to run the business, each acting on the company’s instructions or under its own agreement with the company:

• Supabase: database, authentication and background workers.
• Vercel: application hosting.
• Shopify: webshop orders.
• Turis: wholesale ordering.
• Shipmondo: carrier bookings, labels and tracking.
• Visma e-conomic: accounting and invoicing.
• Resend: transactional email to customers.
• Google Workspace: sign-in and internal mail.

Data is not sold and is not used for advertising. Some of these providers process data outside the EU and EEA; where they do, transfers rely on the European Commission’s standard contractual clauses or an adequacy decision.

Order, shipment and invoice records are kept for five years from the end of the financial year they belong to, as the Danish Bookkeeping Act requires. User accounts are removed when the person no longer needs access. Operational logs are kept for as long as they are useful for troubleshooting and no longer.

You may request access to your personal data, correction of it, erasure, restriction of processing, and portability, and you may object to processing based on legitimate interest. Write to info@polymerworkshop.com.

You may also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

This policy may be updated. The version published at this address is the one that applies.